ydlee - Token precision problem will cause mintUBIFromReserveBalance to not work properly.

[sherlock-admin2]

ydlee

Medium

Token precision problem will cause mintUBIFromReserveBalance to not work properly.

Summary

The mintUBIFromReserveBalance function may not work properly when the decimals of reserve asset token is less than 18, as different token precisions are used when calculating additionalReserveBalance.

Root Cause

In mintUBIFromReserveBalance, the precision of contractReserveBalance is 10 ** reserveDecimals, while exchange.reserveBalance is 10 ** 18. If the decimals of reserve asset token is less than 18, the precisions will be different and the resulted additionalReserveBalance will be incorrect.

// GoodDollarExpansionController.sol: mintUBIFromReserveBalance

157:  uint256 contractReserveBalance = IERC20(exchange.reserveAsset).balanceOf(reserve);
158:  uint256 additionalReserveBalance = contractReserveBalance - exchange.reserveBalance;
159:  if (additionalReserveBalance > 0) {
160:    amountMinted = goodDollarExchangeProvider.mintFromInterest(exchangeId, additionalReserveBalance);
        IGoodDollar(exchange.tokenAddress).mint(address(distributionHelper), amountMinted);

https://github.com/sherlock-audit/2024-10-mento-update/blob/main/mento-core/contracts/goodDollar/GoodDollarExpansionController.sol#L157-L160

The precision of exchange.reserveBalance is 10 ** 18, which can be seen in GoodDollarExchangeProvider.sol:185.

// GoodDollarExchangeProvider.sol: mintFromInterest

178:  uint256 reserveinterestScaled = reserveInterest * tokenPrecisionMultipliers[exchange.reserveAsset];
      uint256 amountToMintScaled = unwrap(
        wrap(reserveinterestScaled).mul(wrap(exchange.tokenSupply)).div(wrap(exchange.reserveBalance))
      );
      amountToMint = amountToMintScaled / tokenPrecisionMultipliers[exchange.tokenAddress];

      exchanges[exchangeId].tokenSupply += amountToMintScaled;
185:  exchanges[exchangeId].reserveBalance += reserveinterestScaled;

https://github.com/sherlock-audit/2024-10-mento-update/blob/main/mento-core/contracts/goodDollar/GoodDollarExchangeProvider.sol#L178-L185

Internal pre-conditions

1. The decimals of reserve asset token is less than 18.

External pre-conditions

No response

Attack Path

No response

Impact

The mintUBIFromReserveBalance function may not work as expected when the decimals of reserve asset token is less than 18.

PoC

No response

Mitigation

// GoodDollarExpansionController.sol: mintUBIFromReserveBalance

    uint256 contractReserveBalance = IERC20(exchange.reserveAsset).balanceOf(reserve);
-   uint256 additionalReserveBalance = contractReserveBalance - exchange.reserveBalance;
+   uint256 reserveAssetDecimals = IERC20(exchange.reserveAsset).decimals();
+   uint256 reservePrecisionMultipliers = 10 ** (18 - uint256(reserveAssetDecimals));
+   uint256 additionalReserveBalance = contractReserveBalance - exchange.reserveBalance / reservePrecisionMultipliers;

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits:
mento-protocol/mento-core#551